GHSA-5c7w-4wm3-85vw @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
An attacker can inject GraphQL metacharacters via interpolated values in the gql tag, potentially executing arbitrary queries or accessing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5c7w-4wm3-85vw?
GHSA-5c7w-4wm3-85vw is a code injection vulnerability in @asymmetric-effort/specifyjs, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Finding
Location: core/src/client/graphql.ts:66-80
The gql template tag function warned about interpolated values containing GraphQL metacharacters ({}():) but still concatenated them into the query string, enabling potential GraphQL injection.
Status
Fixed in v0.2.136 — The gql function now throws an error when metacharacters are detected in interpolated values, forcing developers to use the variables parameter.
Which versions are affected by GHSA-5c7w-4wm3-85vw?
2 open source packages ship an affected version, including @asymmetric-effort/specifyjs.
| Package | Affected | Fixed in |
|---|---|---|
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
@asymmetric-effort/specifyjs npm | All versions | 0.2.136 |
How do I fix GHSA-5c7w-4wm3-85vw?
Upgrade @asymmetric-effort/specifyjs to 0.2.136 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-5c7w-4wm3-85vw being exploited?
There is no known exploitation of GHSA-5c7w-4wm3-85vw in the wild and no public exploit code.